Description
parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindings_zoo' feature, specifically when processing gguf format model files.
Published: 2024-07-02
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-44465 parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindings_zoo' feature, specifically when processing gguf format model files.
History

Wed, 09 Jul 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Lollms
Lollms lollms Web Ui
CPEs cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*
Vendors & Products Lollms
Lollms lollms Web Ui

Subscriptions

Lollms Lollms Web Ui
Parisneo Lollms-webui
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published:

Updated: 2024-08-01T20:55:10.244Z

Reserved: 2024-05-15T06:14:07.065Z

Link: CVE-2024-4897

cve-icon Vulnrichment

Updated: 2024-07-03T19:24:57.269Z

cve-icon NVD

Status : Analyzed

Published: 2024-07-02T15:15:11.853

Modified: 2026-06-17T08:03:07.717

Link: CVE-2024-4897

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-76

    Improper Neutralization of Equivalent Special Elements